Other trends that Symantec spotted during the second half of 2003 show a huge increase in the number of exploits that took advantage of existing backdoors planted on previously-compromised computers. The number of submissions of worms and viruses that targeted backdoors to plant their own code -- from key loggers to updates of the original worm -- jumped by some 276 percent in 2003 over the previous year, and now account for almost half of malware referred to Symantec by its customers.
That trend spilled over into 2004, with worms such as MyDoom, which planted a backdoor used by other worms, including Doomjuice, to re-infect systems with a new wave of malicious code.
"Backdoors are effectively holes in the perimeter of an enterprise network," said Dunphy. "Increasingly, attackers are simply looking for backdoors, and users should definitely expect this to continue."
More malicious code is also packed with its own mail server, a tactic that hackers have used to bypass gateway defenses companies have established for outgoing messages. Amongst the worms submitted to Symantec, for instance, 61 percent more came packaged with their own SMTP engines in the second half of 2003 compared to the first half.
"It vastly improves the effectiveness of that worm to propagate," said Dunphy.